Enable AL-Go for GitHub on GitHub Enterprise Cloud with data residency

.github/workflows/CI.yaml

@@ -36,6 +36,14 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Verify AL-Go runs on github.com
+        run: |
+          $serverHost = ([Uri]$env:GITHUB_SERVER_URL).Host
+          if ($serverHost -ne 'github.com') {
+            Write-Host "::error::AL-Go for GitHub itself must run on github.com (detected host '$serverHost'). Developing/running the AL-Go repository on GitHub Enterprise (GHE) is not supported. Note that repositories using AL-Go for GitHub are supported on GHE - this restriction only applies to the AL-Go for GitHub repository itself."
+            exit 1
+          }
+
       - name: Run AL-Go Actions Tests (${{ matrix.psVersion }})
         run: |
           . (Join-Path "." "Tests/runtests.ps1") -Path "Tests"

Actions/AL-Go-Helper.ps1

@@ -27,7 +27,7 @@ $RepoSettingsFile = Join-Path '.github' 'AL-Go-Settings.json'
 $defaultCICDPushBranches = @( 'main', 'release/*', 'feature/*' )
 [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', 'defaultCICDPullRequestBranches', Justification = 'False positive.')]
 $defaultCICDPullRequestBranches = @( 'main' )
-$defaultBcContainerHelperVersion = "preview"
+$defaultBcContainerHelperVersion = "https://github.com/Freddy-DK/navcontainerhelper/archive/refs/heads/main.zip"
 $notSecretProperties = @("Scopes","TenantId","BlobName","ContainerName","StorageAccountName","ServerUrl","ppUserName","GitHubAppClientId","EnvironmentName")
 
 $runAlPipelineOverrides = @(
@@ -931,10 +931,10 @@ function CheckAppDependencyProbingPaths {
                 throw "The Setting AppDependencyProbingPaths needs to contain a repo property, pointing to the repository on which your project have a dependency"
             }
             if ($dependency.Repo -eq ".") {
-                $dependency.Repo = "https://github.com/$repository"
+                $dependency.Repo = "$($ENV:GITHUB_SERVER_URL)/$repository"
             }
             elseif ($dependency.Repo -notlike "https://*") {
-                $dependency.Repo = "https://github.com/$($dependency.Repo)"
+                $dependency.Repo = "$($ENV:GITHUB_SERVER_URL)/$($dependency.Repo)"
             }
             if (-not ($dependency.PsObject.Properties.name -eq "Version")) {
                 $dependency | Add-Member -name "Version" -MemberType NoteProperty -Value "latest"
@@ -988,7 +988,7 @@ function CheckAppDependencyProbingPaths {
             }
 
             if ($dependency.release_status -eq "include") {
-                if ($dependency.Repo -ne "https://github.com/$repository") {
+                if ($dependency.Repo -ne "$($ENV:GITHUB_SERVER_URL)/$repository") {
                     OutputWarning "Dependencies with release_status 'include' must be to other projects in the same repository."
                 }
                 else {
@@ -1661,7 +1661,7 @@ function CreateDevEnv {
                         New-Object -Type PSObject -Property $_
                     }
                 })
-            GetDependencies -probingPathsJson $settings.appDependencyProbingPaths -saveToPath $dependenciesFolder -api_url 'https://api.github.com' | ForEach-Object {
+            GetDependencies -probingPathsJson $settings.appDependencyProbingPaths -saveToPath $dependenciesFolder -api_url $ENV:GITHUB_API_URL | ForEach-Object {
                 if ($_.startswith('(')) {
                     $installTestApps += $_
                 }

Actions/CheckForUpdates/CheckForUpdates.HelperFunctions.ps1

@@ -21,19 +21,43 @@ function DownloadTemplateRepository {
         [bool] $downloadLatest
     )
 
+    # Construct API URL
+    if ($templateUrl -like 'https://github.com/*') {
+        # templateUrl is github.com - use the github.com API URL
+        $apiUrl = $templateUrl.Split('@')[0] -replace "^($([regex]::Escape('https://github.com') -replace '/', '\/'))/(.*)$", "https://api.github.com/repos/`$2"
+    }
+    else {
+        # templateUrl is not github.com (e.g. github enterprise) - use the GITHUB_SERVER_URL and GITHUB_API_URL environment variables
+        $apiUrl = $templateUrl.Split('@')[0] -replace "^($([regex]::Escape($env:GITHUB_SERVER_URL) -replace '/', '\/'))/(.*)$", "$ENV:GITHUB_API_URL/repos/`$2"
+    }
+
+    Write-Host "TemplateUrl: $templateUrl"
+    Write-Host "ApiUrl: $apiUrl"
+    Write-Host "TemplateSha: $($templateSha.Value)"
+    Write-Host "DownloadLatest: $downloadLatest"
+
     $templateRepositoryUrl = $templateUrl.Split('@')[0]
     $templateRepository = $templateRepositoryUrl.Split('/')[-2..-1] -join '/'
 
     # Use Authenticated API request if possible to avoid the 60 API calls per hour limit
-    OutputDebug -message "Getting template repository ($templateRepository) with GITHUB_TOKEN"
-    $headers = GetHeaders -token $env:GITHUB_TOKEN -repository $templateRepository
+    if ($templateUrl -like "$env:GITHUB_SERVER_URL/*") {
+        # Use authenticated request if the templateUrl is on the same GitHub server as the current repository
+        Write-Host "Getting template repository ($templateRepository) with GITHUB_TOKEN"
+        $headers = GetHeaders -token $env:GITHUB_TOKEN -repository $templateRepository
+    }
+    else {
+        # Use unauthenticated request if the templateUrl is on a different GitHub server
+        Write-Host "Getting template repository ($templateRepository) anonymously"
+        $headers = GetHeaders -repository $templateRepository
+    }
     try {
+        # This ONLY fails if the template repository is private/internal and the GITHUB_TOKEN does not have access to it
         $response = Invoke-WebRequest -UseBasicParsing -Headers $headers -Method Head -Uri $templateRepositoryUrl
         OutputDebug -message ($response | Format-List | Out-String)
     }
     catch {
         # Ignore error
-        OutputDebug -message "Error getting template repository with GITHUB_TOKEN:"
+        OutputDebug -message "Error getting template repository:"
         OutputDebug -message $_
         $response = $null
     }
@@ -44,13 +68,6 @@ function DownloadTemplateRepository {
         $headers = GetHeaders -token $token -repository $templateRepository
     }
 
-    # Construct API URL
-    $apiUrl = $templateUrl.Split('@')[0] -replace "^(https:\/\/github\.com\/)(.*)$", "$ENV:GITHUB_API_URL/repos/`$2"
-
-    Write-Host "TemplateUrl: $templateUrl"
-    Write-Host "TemplateSha: $($templateSha.Value)"
-    Write-Host "DownloadLatest: $downloadLatest"
-
     if ($downloadLatest) {
         # Get latest commit SHA from the template repository
         $templateSha.Value = GetLatestTemplateSha -headers $headers -apiUrl $apiUrl -templateUrl $templateUrl
@@ -78,7 +95,10 @@ function GetLatestTemplateSha {
     $branch = $templateUrl.Split('@')[1]
     Write-Host "Get latest SHA for $templateUrl"
     try {
-        $branchInfo = (InvokeWebRequest -Headers $headers -Uri "$apiUrl/branches/$branch").Content | ConvertFrom-Json
+        $url = "$apiUrl/branches/$branch"
+        Write-Host "Api URL: $url"
+        $result = Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri $url
+        $branchInfo = $result.Content | ConvertFrom-Json
     } catch {
         throw "Failed to update AL-Go System Files. Could not get the latest SHA from template ($templateUrl). (Error was $($_.Exception.Message))"
     }
@@ -954,6 +974,7 @@ function GetDefaultFilesToInclude {
     $filesToInclude = @(
         [ordered]@{ 'sourceFolder' = '.github/workflows'; 'filter' = '*.yaml'; 'type' = 'workflow' }
         [ordered]@{ 'sourceFolder' = '.github/workflows'; 'filter' = '*.yml'; 'type' = 'workflow' }
+        [ordered]@{ 'sourceFolder' = '.github/workflows'; 'filter' = '*.md'; 'type' = 'agentic workflow' }
         [ordered]@{ 'sourceFolder' = '.github'; 'filter' = '*.copy.md' }
         [ordered]@{ 'sourceFolder' = '.github'; 'filter' = '*.ps1' }
         [ordered]@{ 'sourceFolder' = '.github'; 'filter' = "$RepoSettingsFileName"; 'type' = 'settings' }

Actions/CheckForUpdates/CheckForUpdates.ps1

@@ -239,7 +239,7 @@ else {
         # Get Token with permissions to modify workflows in this repository
         $repoWriteToken = GetAccessToken -token $token -permissions @{"actions"="read";"contents"="write";"pull_requests"="write";"workflows"="write"}
         $env:GH_TOKEN = $repoWriteToken
-
+        $env:GH_HOST = ([Uri]$env:GITHUB_SERVER_URL).Host
         $existingPullRequest = (gh api --paginate "/repos/$env:GITHUB_REPOSITORY/pulls?base=$updateBranch" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" | ConvertFrom-Json) | Where-Object { $_.title -eq $commitMessage } | Select-Object -First 1
         if ($existingPullRequest) {
             OutputWarning "Pull request already exists for $($commitMessage): $($existingPullRequest.html_url)."

Actions/Deploy/Deploy.psm1

@@ -22,7 +22,7 @@ function GetHeadRefFromPRId {
 
     $headers = GetHeaders -token $token
 
-    $pullsURI = "https://api.github.com/repos/$repository/pulls/$prId"
+    $pullsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/pulls/$prId"
     Write-Host "- $pullsURI"
     $pr = (InvokeWebRequest -Headers $headers -Uri $pullsURI).Content | ConvertFrom-Json
 

Actions/DetermineProjectsToBuild/DetermineProjectsToBuild.Action.ps1

@@ -88,7 +88,7 @@ Trace-Information -Message "Incremental builds (projects)" -AdditionalData $addi
 
 # Add annotation for last known good build
 if ($baselineWorkflowRunId) {
-    Write-Host "::notice::Last known good build: https://github.com/$($env:GITHUB_REPOSITORY)/actions/runs/$baselineWorkflowRunId"
+    Write-Host "::notice::Last known good build: $($env:GITHUB_SERVER_URL)/$($env:GITHUB_REPOSITORY)/actions/runs/$baselineWorkflowRunId"
 }
 
 # Set output variables

Actions/DetermineProjectsToBuild/DetermineProjectsToBuild.psm1

@@ -173,6 +173,8 @@ function Get-ProjectsToBuild {
         $modifiedProjects = @()
         $projectsToBuild = @()
         $projectsOrderToBuild = @()
+        # Initialize in case no projects are found
+        $projectBuildInfo = @{ projectDependencies = @{} }
 
         if ($projects) {
             # Calculate the full projects order

Actions/DownloadProjectDependencies/DownloadProjectDependencies.psm1

@@ -299,23 +299,27 @@ function Get-DependenciesFromInstallApps {
             }
             Write-Host "Processing install$($list) entry: $appFile"
 
-            # If the app file is not a URL, resolve local path.
-            if ($appFile -notlike 'http*://*') {
-                $updatedListOfFiles += Get-AppFilesFromLocalPath -Path $appFile -DestinationPath $DestinationPath
-            } else {
-                # Else, check for secrets in the URL and replace them. Only match on the first occurrence of the pattern ${{ secretName }}
-                $appFileUrl = $appFile
-                $pattern = '.*(\$\{\{\s*([^}]+?)\s*\}\}).*'
-                if ($appFile -match $pattern) {
-                    $secretName = $matches[2]
-                    if (-not $secrets.ContainsKey($secretName) -or [string]::IsNullOrEmpty($secrets."$secretName")) {
-                        throw "Setting: install$($list) references unknown secret '$secretName' in URL: $appFile"
-                    }
-                    $appFileUrl = $appFileUrl.Replace($matches[1],[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($secrets."$secretName")))
+            # Resolve any secret placeholder first, so classification (URL vs local path) is done against
+            # the resolved value. This supports the case where the entire URL is stored in a secret.
+            # Only match on the first occurrence of the pattern ${{ secretName }}.
+            $cleanAppFile = $appFile
+            $appFileUrl = $appFile
+            $pattern = '.*(\$\{\{\s*([^}]+?)\s*\}\}).*'
+            if ($appFile -match $pattern) {
+                $secretName = $matches[2]
+                if (-not $secrets.ContainsKey($secretName) -or [string]::IsNullOrEmpty($secrets."$secretName")) {
+                    throw "Setting: install$($list) references unknown secret '$secretName' in: $appFile"
                 }
+                $appFileUrl = $appFileUrl.Replace($matches[1],[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($secrets."$secretName")))
+            }
 
+            # If the resolved app file is not a URL, resolve local path.
+            if ($appFileUrl -notlike 'http*://*') {
+                $updatedListOfFiles += Get-AppFilesFromLocalPath -Path $appFileUrl -DestinationPath $DestinationPath
+            } else {
                 # Download the file (may return multiple .app files if it's a zip)
-                $appFiles = Get-AppFilesFromUrl -Url $appFileUrl -CleanUrl $appFile -DownloadPath $DestinationPath
+                # Pass the unresolved value as CleanUrl so secret values aren't leaked into logs.
+                $appFiles = Get-AppFilesFromUrl -Url $appFileUrl -CleanUrl $cleanAppFile -DownloadPath $DestinationPath
 
                 $updatedListOfFiles += $appFiles
             }

Actions/GetArtifactsForDeployment/GetArtifactsForDeployment.ps1

@@ -79,7 +79,7 @@ elseif ($artifactsVersion -like "PR_*") {
     }
     $latestPRBuildId, $lastKnownGoodBuildId = FindLatestPRRun -repository $ENV:GITHUB_REPOSITORY -commitSha $prLatestCommitSha -token $token
     if ($latestPRBuildId -eq 0) {
-        $prLink = "https://github.com/$($ENV:GITHUB_REPOSITORY)/pull/$prId"
+        $prLink = "$($ENV:GITHUB_SERVER_URL)/$($ENV:GITHUB_REPOSITORY)/pull/$prId"
         throw "Latest PR build for PR $prId not found, not completed or not successful - Please re-run this workflow when you have a successful build on PR_$prId ($prLink)"
     }
 
@@ -102,7 +102,7 @@ elseif ($artifactsVersion -like "PR_*") {
     }
 
     if ($expiredArtifacts) {
-        $prBuildLink = "https://github.com/$($ENV:GITHUB_REPOSITORY)/actions/runs/$latestPRBuildId"
+        $prBuildLink = "$($ENV:GITHUB_SERVER_URL)/$($ENV:GITHUB_REPOSITORY)/actions/runs/$latestPRBuildId"
         $shortLivedRetentionSettingLink = "https://aka.ms/algosettings#shortLivedArtifactsRetentionDays"
         throw "Build artifacts are expired, please re-run the pull request build ($prBuildLink). Note that you can control the retention days of short-lived artifacts using the AL-Go setting ShortLivedArtifactsRetentionDays. See $shortLivedRetentionSettingLink"
     }

Actions/GetArtifactsForDeployment/GetArtifactsForDeployment.psm1

@@ -25,7 +25,7 @@ function FindPRRunAnnotationForIncrementalBuilds {
 
     Write-Host "Finding PR run annotation for incremental builds in repository $repository"
 
-    $checkRunsURI = "https://api.github.com/repos/$repository/check-suites/$checkSuiteId/check-runs"
+    $checkRunsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/check-suites/$checkSuiteId/check-runs"
     Write-Host "- $checkRunsURI"
 
     $checkRuns = (InvokeWebRequest -Headers $headers -Uri $checkRunsURI).Content | ConvertFrom-Json
@@ -47,7 +47,7 @@ function FindPRRunAnnotationForIncrementalBuilds {
         $annotations = (InvokeWebRequest -Headers $headers -Uri $annotationsURI).Content | ConvertFrom-Json
         if($annotations -and $annotations.count -gt 0) {
             foreach($annotation in $annotations) {
-                if($annotation.message -match "Last known good build: https://github.com/$repository/actions/runs/([0-9]{1,11})") {
+                if($annotation.message -match "Last known good build: $($ENV:GITHUB_SERVER_URL)/$repository/actions/runs/([0-9]{1,11})") {
                     Write-Host "Found PR run annotation message: $($annotation.message)"
                     $lastKnownGoodBuildId = $matches[1]
                     break
@@ -92,7 +92,7 @@ function FindLatestPRRun {
 
     while($true) {
         # Get all workflow runs for the given commit sha
-        $runsURI = "https://api.github.com/repos/$repository/actions/runs?per_page=$per_page&page=$page&head_sha=$commitSha"
+        $runsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/actions/runs?per_page=$per_page&page=$page&head_sha=$commitSha"
         Write-Host "- $runsURI"
         $workflowRuns = (InvokeWebRequest -Headers $headers -Uri $runsURI).Content | ConvertFrom-Json
 
@@ -305,7 +305,7 @@ function GetLatestCommitShaFromPRId {
 
     $headers = GetHeaders -token $token
 
-    $pullsURI = "https://api.github.com/repos/$repository/pulls/$prId"
+    $pullsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/pulls/$prId"
     Write-Host "- $pullsURI"
     $pr = (InvokeWebRequest -Headers $headers -Uri $pullsURI).Content | ConvertFrom-Json
 
@@ -334,7 +334,7 @@ function GetHeadRefFromRunId {
 
     $headers = GetHeaders -token $token
 
-    $runsURI = "https://api.github.com/repos/$repository/actions/runs/$runId"
+    $runsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/actions/runs/$runId"
     Write-Host "- $runsURI"
 
     $run = (InvokeWebRequest -Headers $headers -Uri $runsURI).Content | ConvertFrom-Json